Skip to main content

Hi guys!

 

I created a block for disabling users, in AD and in other technologies, like Azure AD and so on, it depends on the customer.

 

I want to give the analyst the oportunnity to pass the users, i mean manually pass the user to block.

 

Is there any action to do this? 

 

Thanks!!

Your analysts can run manual actions - https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/what-actions-can-you-take-on-a-case. You can also create a quick action for them to execute.


Your analysts can run manual actions - https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/what-actions-can-you-take-on-a-case. You can also create a quick action for them to execute.

Thank you